As is known, digital certificates are being employed in networked environments to, among other things, act as a proffer that the owner of the certificate is indeed the entity named in the certificate, and also to act as a proffer that some corresponding element to which the certificate is related is authentic and/or trustworthy or the like. For example, a digital application that is to be operated on a computing device may be accompanied by an application certificate proffering that the application can be trusted to operate in a particular manner. Likewise, a user operating such a computing device may be represented thereon and/or elsewhere by a user certificate proffering that the user is a particular person, has particular user rights, belongs to particular user groups, etc. As may be appreciated, other instances where a digital certificate may be employed include in connection with digital constructs such as digital files, digital content, digital licenses for employing digital content, and the like. Similarly, a digital certificate may be issued for a computing device itself, and various of the hardware elements (the hard drive, the processor, the video card, etc.) and software elements (the BIOS, the operating system, the graphics sub-system, etc.) within the computing device may each have a digital certificate.
Typically, a digital certificate is issued by a particular certificate authority as identified in the certificate to the named owner as set forth in the certificate, and includes therein one or more cryptographic keys such as for example a public key from a public-private key pair. Especially in the case where such key is indeed a public key, a corresponding private key is associated with such certificate and is presumably held closely as a secret by the named owner of the certificate.
Thus, among other things, the named owner may employ the private key to digitally sign some sort of electronic document, and may attach the certificate to the electronic document. A recipient of the electronic document with the certificate may at some point then validate the digital signature with the public key from the certificate, as is known, to confirm that the electronic document has not been modified, among other things. Of course, digital certificates may also be employed in many other circumstances.
As is known, a digital certificate as issued by a certificate authority may include a chain of digital certificates leading back to a root digital certificate from a trusted root authority, where each certificate in the chain includes a public key that can be employed to validate the signature of the next certificate down the chain, presuming that a client with the chain of certificates has knowledge of the public key of the root certificate. Thus, for a client to validate a particular certificate with an attached chain of certificates, the client first validates each certificate in the chain from the root certificate down to the particular certificate. In addition, if any further certificate is issued based on the particular certificate, i.e., is signed by the private key corresponding to such particular certificate, such further certificate can be validated by continuing the process down the chain to such further certificate.
Significantly, a certificate authority that issues a particular certificate typically has the power to revoke same. Reasons for revoking a certificate are many and varied, and can for example include age of the certificate and/or the underlying entity represented by the certificate, and changed status. Principally, though, a certificate is revoked when the information in such certificate can no longer be relied on to be accurate. Notably, a certificate may be revoked by the issuing certificate authority if it is determined that the private key corresponding to such certificate has been publicized or otherwise disclosed, with the result being that anybody with such private key can employ same to digitally sign, and not just the owner of the certificate. Also notably, a certificate may be revoked by the issuing certificate authority if such certificate authority discovers that the named owner is improperly employing the certificate, such as for example by misrepresenting that an element can be trusted based on the certificate, or by employing the certificate for a different purpose than that which the certificate was issued.
To revoke a certificate, the issuing certificate authority or the like may for example publicly listing the public key associated with the certificate in an accessible location. Heretofore, such accessible location was a digital revocation list that was periodically provided to each client, for example as an attachment to another digital construct. Thus, the client in verifying any particular certificate to authenticate the corresponding element may obtain from the issuer thereof a corresponding revocation list and review same to determine whether the certificate is revoked, and if so may refuse to honor the certificate and correspondingly refuse to honor/authenticate/trust/etc. the digital element to which the certificate corresponds.
However, and significantly, obtaining and reviewing revocation lists can quickly become cumbersome if not oppressive for a client, especially if the client requires revocation lists from multiple certificate authorities, and also especially if the revocation lists become large and/or complicated in structure. Moreover, and at any rate, it is to be appreciated that inasmuch as revocation lists are not necessarily provided immediately to a client and/or are not necessarily obtained immediately by a client, a certificate that has been revoked may nevertheless be honored by the client for quite some time until a corresponding revocation list is in fact in the possession of the client.
Accordingly, a need exists for a centralized service with access to current revocation information such that a client can in a prompt and current fashion determine whether a particular digital certificate has been revoked. In particular, a need exists for such a centralized service that can access multiple repositories of revocation information such that the client can contact the service to obtain revocation information relating to a certificate as issued by any of a plurality of certificate authorities. Moreover, a need exists for such a centralized service that allows for easily adding additional repositories of revocation information and that is easily configured to locate the appropriate repository of revocation information for any of a plurality of particular certificates.